Phantom double Parameters when send email

[bviehmann]

hello I scan systems with nessus on vulnerbilities and send them to splunk.

With phantom I could generate emails. An event is a system for me and the vulnerbilities are the artifacts. When i send an email then some parameters will come up double .... how can i change that?

here an example:

Guten Tag Herr Tobias, Tobias

Betroffene Plattform
IP: 10.11.12.13, 10.11.12.13
Hostname: 244.abc.de, 244.abc.de

Sicherheitsrisiko: high, high

80/TCP, 443/TCP
blabla,

Lösungsvorschlag:
Unknown at this time., Unknown at this time

[cblumer_splunk]

For your Use Case you will most likely want to use the Format Block's _as_list feature:
https://my.phantom.us/4.5/docs/automation/api_playbook#format

You Format Block template can look like this:

Use this DataPath to pass the full output of the Format Block to the 'body' parameter of the Send Email action block:
format_1:formatted_data

And your Email Body will look like this:

[bviehmann]

@rsantoso_splunk here is an example from my playbook

[rsantoso_splunk]

@bviehmann, please check your artifact's event to see either of the following?
1. The Artifact deviceAddress contains two address 10.11.12.13, 10.11.12.13 Or
2. There are two Artifacts that contain the same address 10.11.12.13

[rsantoso_splunk]

Hi bviehmann,

I assume you use the format Template to fill in your email body?
How is the template and parameters look like?

Please check the format block documentation if you not already have:
https://my.phantom.us/4.1/docs/vpe/editor#format

[bviehmann]

Hi @rsantoso_splunk
yes i use the format Template .... in the documentation i dont find anythin about my problem ..(